2024-12-16

Cloudflare Warp Endpoint 连通性测试/自动更换

0、前言

前段时间入手了一台灵到不能再灵的国内机，折后 33.6 一年，1C 1G 1000M（共享），还不需要实名，于是在跑路到期前必须得折腾些什么。有什么比 IP：中国 并且能访问 Google/YouTube/X（Twitter）等网站更 Cool 呢？Cloudflare Warp 就能实现。

1、配置 Cloudflare Warp

使用 fscarmen 的脚本：

WGCF
https://gitlab.com/fscarmen/warp

以非全局方式启动 Warp，此时使用 WireGuard 连接 Warp，指定网卡为 warp 时流量会通过 Warp。

2、配置 XrayR

难得获得一个免实名国内出口 IP，我希望访问国内网站时都使用自带 NAT 出口，访问国外网站时再使用 Warp。

设置 /etc/XrayR/route.json：

json

     {
  "domainStrategy": "IPOnDemand",
  "rules": [
    {
    "outboundTag": "block",
    "ip": [
      "geoip:private"
    ]
    },
    {
    "outboundTag": "block",
    "protocol": [
      "bittorrent"
    ]
    },
    {
      "type": "field",
      "outboundTag": "direct",
      "domain": [
        "geosite:cn"
      ]
    },
    {
      "type": "field",
      "outboundTag": "direct",
      "ip": [
        "geoip:cn"
      ]
    },
    {
      "type": "field",
      "outboundTag": "warp",
      "network": "tcp,udp"
    }
  ]
}  
  

即：默认走 Warp，国内走直连。

修改 /etc/XrayR/custom_outbound.json：

json

     [
  {
    "protocol": "freedom",
    "settings": {},
    "tag": "direct"
  },
  {
    "tag": "warp",
    "protocol": "freedom",
    "streamSettings": {
      "sockopt": {
        "interface": "warp"
      }
    }
  },
  {
    "protocol": "blackhole",
    "tag": "block"
  }
]  
  

其实 Xray 的出站就可以添加 WireGuard，例如：

json

     [
  {
    "tag": "IPv4_out",
    "protocol": "freedom",
    "settings": {
      "domainStrategy": "UseIPv4v6"
    }
  },
  {
    "tag": "IPv6_out",
    "protocol": "freedom",
    "settings": {
      "domainStrategy": "UseIPv6"
    }
  },
  {
    "protocol": "wireguard",
    "tag": "warp",
    "settings": {
        "secretKey": "2DRzSLT1OBh+mN4fxZc+gu+hfYb8X4a9d0oD5NCb60Q=",
        "address":[
            "172.16.0.2/32",
            "2606:4700:110:8e15:9080:66bd:20e8:c4e7/128"
        ],
        "mtu": 1380,
        "reserved": [45, 85, 21],
        "peers": [
            {
                "publicKey": "bmXOC+F1FxEMF9dyiK2H5/1SUtzH0JuVo51h2wPfgyo=",
                "endpoint": "engage.cloudflareclient.com:2408",
                "keepAlive": 25
            }
        ]
    }
  },
  {
    "protocol": "blackhole",
    "tag": "block"
  }
]  
  

提示：
上述配置为 XrayR 魔改版提供，为 Cloudflare Zero Trust（Teams），经测试确实可用。目前 Zero Trust 应该是同配置可以跨设备公用，设备数等限制未知。

然而使用 WGCF 脚本可以自动优选 Endpoint，而且后面会提到需要对 WireGuard 配置文件进行修改，如果写入出站配置，修改后需要重启 XrayR 生效，不如直接指定网卡。

3、自动脚本

先选择一个目录，例如 ~/warp，安装必要程序：

Bash

     mkdir ~/warp
cd ~/warp

ARCH=$(uname -m)
case "$ARCH" in
    i386 | i686 ) ARCH='386' ;;
    x86_64 | amd64 ) ARCH='amd64' ;;
    armv8 | arm64 | aarch64 ) ARCH='arm64' ;;
    s390x ) ARCH='s390x' ;;
    * ) echo "不支持的CPU架构!" && exit 1 ;;
esac

wget https://gitlab.com/Misaka-blog/warp-script/-/raw/main/files/warp-yxip/warp-linux-$ARCH -O warp-test  
  

然后新建脚本，例如 ~/warp/monitor.sh，写入：

Bash

     #!/bin/bash

# Step 1: curl with 10 seconds timeout
curl --interface warp --max-time 10 https://www.cloudflare.com/cdn-cgi/trace > /dev/null 2>&1
if [ $? -eq 0 ]; then
    echo "Connection success"
    exit 0
fi
echo "Connection failed"

# Step 2: If curl times out, clear result.csv and run warp-test
> ./result.csv
./warp-test

# Step 3: Check if result.csv has content
if [ ! -s ./result.csv ]; then
    echo "Warp IPv4 test failed"
    ./warp-test -ipv6
fi
if [ ! -s ./result.csv ]; then
    echo "Warp IPv6 test failed"
    exit 1
fi
echo "Warp IPv4/v6 test success"

# Step 4: Extract the second line's IP:PORT
endpoint=$(awk -F, 'NR==2 {print $1}' ./result.csv)

# Step 5: Replace Endpoint in /etc/wireguard/warp.conf
sed -i "s|^Endpoint = .*|Endpoint = $endpoint|" /etc/wireguard/warp.conf

# Step 6: Restart WireGuard
wg-quick down warp && wg-quick up warp
if [ $? -eq 0 ]; then
    echo "Warp restart success"
else
    echo "Warp restart failed"
fi  
  